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Information Commissioner's Office 


DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


To: Repair & Assure Ltd 


Of: Suite C, Second Floor, Redhill Chambers, 2d, High Street, Redhill 
RH1 1R) 


1. The Information Commissioner (“Commissioner”) has decided to issue 
Repair & Assure Ltd (“RAL”) with a monetary penalty under section 55A 
of the Data Protection Act 1998 (“DPA”). The penalty is being issued 
because of a serious contravention of regulation 21 of the Privacy and 


Electronic Communications (EC Directive) Regulations 2003. 


2. This notice explains the Commissioner’s decision. 


Legal framework 


3. RAL, whose registered office address is given above (Companies House 
Registration Number: 10539230), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


4. Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. It means that if a company wants to make calls 
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promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
5. Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
6. Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 


a caller that he does not, for the time being, object to such calls 
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being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at any 
time, and 
(b) where such notification is withdrawn, the caller shall not make such 


calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 

that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
set up by the Commissioner to carry out this role. Businesses who wish 
to carry out direct marketing by telephone can subscribe to the TPS for 


a fee and receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of advertising material which is 
directed to particular individuals”. This definition also applies for the 


purposes of PECR. 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 
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Under section 55A (1) of the DPA (as amended by PECR 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 


2015) the Commissioner may serve a person with a monetary penalty 


notice if the Commissioner is satisfied that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 


2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the |CO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 


electronic communications sector. PECR were amended for the purpose 
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of giving effect to Directive 2009/136/EC which amended and 


strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


RAL came to the attention of the Commissioner after the TPS received 
high volumes of complaints for unsolicited live marketing calls about 


washing machine warranties. 


As the organisation named in the complaints, RAL was sent an initial 
investigation letter by the Commissioner on 11 January 2019 which 
detailed concerns with RAL’s compliance with PECR and requested, 
amongst other things, the source of the data relied on for their direct 


marketing, and evidence of consent. 


The response which followed advised that all of the data relied on by 
RAL for the purposes of its direct marketing was obtained from twelve 
third party data suppliers (the “data suppliers”). RAL also advised that 
it did not screen the data obtained against the TPS register; that the 
data was “direct opt-in”, and listed the due diligence measures that it 
had in place to ensure the veracity of the data. The Commissioner was 
advised that these measures specifically involved spot checks of the 
data suppliers’ call recordings with individuals through which the 


purported consent was obtained. 


It was subsequently confirmed by RAL in correspondence from 1 March 


2019 that the data obtained by the data suppliers was collected via 
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telephone marketing surveys. With individuals apparently providing 

consent to be contacted by RAL in the course of those surveys. Three 

sample call recordings were provided to demonstrate what individuals 

would be told at the point of consent being obtained. The questions 

asked in these surveys consisted primarily of the individual being asked 

for their washing machine’s brand and age. Two of the three calls 

asked specifically if the individual was over 50 years old with the 


remaining call sample asking for the individual’s age more generally. 


Following further requests for information, on 4 June 2019 RAL 
provided three spreadsheets titled ‘chain of consent’, together with 
signed ‘third party data agreements’ with the data suppliers and copies 
of call scripts used by the data suppliers. Notably, none of the signed 
‘third party data agreements’ are dated before 22 March 2019 which 
suggests that they were put in place after the Commissioner’s initial 
contact with RAL in January 2019. 


The Commissioner subsequently contacted RAL’s Communications 
Service Provider (“CSP”) to establish the volumes of answered calls 
made from CLIs from which there had been complaints about RAL’s 
direct marketing. The CSP confirmed that all of the CLI’s provided by 
the Commissioner were allocated to RAL between 00.01hrs on 1 
January 2019 and 23:59hrs on 10 June 2019. The CSP was able to 
narrow the CLIs which were active over that period and supplied details 
of the Call Detail Records (“CDRs”) which showed how many calls were 
made from those CLIs. The CDR information provided by the CSP was 
forwarded to the TPS to establish how many of the CDRs had been TPS 
registered for not less than 28 days at the time they received a call 
from RAL. The response indicated that between 2 January 2019 and 
11 June 2019 there had been 1,103,292 calls made to numbers which 
had been registered with the TPS for not less than 28 days. 
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The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of Regulation 21 of PECR by RAL and, if so, whether the 


conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that RAL has contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 2 January 2019 and 11 June 2019, RAL used a public 
telecommunications service for the purposes of making 1,103,292 
unsolicited calls to subscribers for direct marketing purposes to 
subscribers where the number allocated to the subscriber in respect of 
the called line was a number listed on the register of numbers kept by 
the Commissioner in accordance with regulation 26, contrary to 
regulation 21(1)(b) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 1,103,292 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to RAL to 


receive calls. 


The Commissioner is further satisfied that there were a total of 88 


complaints to the TPS and ICO arising from these calls. 
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27. The content of the complaints included the following: 


e “My elderly mother was cold-called [...] from Repair & Assure 
regarding insurance for her washing machine. As her machine is 
very old, this made no sense to her. And as she had no recollection 
of ever dealing with this company before, she was very concerned 
that they already knew her name, address and telephone number. 
During the call, [name redacted] also asked my mother if she had a 
mobile, email or direct debit - all details of which my mother did not 


give. She terminated the call shortly after.” 


e “The caller, male, told me my washing machine manufacturer 
warranty was about to expire and they wanted to continue it with a 
35% discount. | asked who the company were and he told me. | 
then said | didn't have any cover with them to continue with and he 
apologised for phrasing it like that. | then said | was registered with 
the TPS so he shouldn't be calling me and he said all | had to say 
was do | want the cover or not! | said no and that | would be 


reporting the call.” 


e “Caller enquired about Hotpoint washing machine that | do not own. 
| own a Zanussi. Prior to any sales pitch, | had informed the caller 
that he was breaking the rules/laws regarding restricted numbers 
and sales calls. He said he was not. | informed him that my number 
is on the TPS service and that by calling he was indeed breaching 
the law regarding this. He again attempted to continue the call at 


which point | put the phone down on him.” 


e “Caller wanted to talk about my washing machine! | told him that | 
did not have such a device and used the local launderette. He called 
me a liar. | told him | was TPS registered and | put the phone down. 


| had received a "silent call" from the same number earlier at 10:29, 


8 


28. 


29. 


30. 


1CO. 


Information Commissioner's Office 


which | have reported to Ofcom.” 


The data used by RAL for the purposes of its direct marketing calls was 
obtained from its twelve data suppliers. To obtain its data, the data 
suppliers sought to carry out telephone surveys with individuals. RAL 
has attempted to provide evidence, albeit unclear evidence, to the 
Commissioner of how four of its twelve data suppliers obtained the 
data which they used for their initial survey calls, but has provided 


nothing for the remaining eight data suppliers used. 


The Commissioner is satisfied that the calls carried out by the data 
suppliers are clearly for the intention of collecting data for use in future 
marketing campaigns (by organisations such as RAL). During these 
calls individuals would be asked to answer some ‘household questions’ 
or to give a ‘valid opinion’ on “leading UK brands”. Once the individual 
agrees to participate in the survey they are asked to confirm their 
personal details, and then provide information regarding their washing 
machine. The Commissioner has been provided with some data 
supplier call samples and whilst RAL are mentioned briefly in the 
samples provided, the Commissioner is concerned that the way in 
which these consents were obtained renders it not sufficiently specific, 


informed or freely given. 


The Commissioner’s direct marketing guidance is very clear that 
informed consent cannot be established when an individual has been 
asked to agree to third party marketing prior to being informed who 
the third-party organisations actually are. In terms of the data supplier 
Surveys, not only are the third parties provided after the apparent 
consent is obtained, but the data suppliers have conflated the 
agreement to marketing with a more veiled request to individuals to 


provide an ‘opinion’ or to answer ‘household questions’ about “UK 
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leading brands”. This strategy of being deliberately opaque about the 
purpose of the call is misleading, and makes it difficult for anybody 
seeking to rely on that consent to demonstrate that the individuals 


could have known precisely what they were agreeing to when they 


agreed to answer some ‘household questions’. 


The Commissioner is further concerned that the ‘third party data 
agreements’ between RAL and the suppliers are not dated before 22 
March 2019, suggesting that there were no such agreements in place 
prior to that date. The Commissioner has clear evidence that calls 
were being made at least as early as 2 January 2019 for the purposes 
of this contravention (with evidence of complaints being made 
significantly earlier) and since no evidence of valid consent has been 
provided, and RAL have confirmed that no TPS checks were undertaken 
prior to making its calls, the Commissioner has concluded that the 


1,103,292 direct marketing calls were not made lawfully. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of Regulation 21 by RAL arising from the organisation’s activities 
between 2 January 2019 and 11 June 2019, and this led to over 1 
million unsolicited direct marketing calls being made to subscribers who 


were registered with the TPS. 


The 1,103,292 unsolicited direct marketing calls made between 2 


January 2019 and 11 June 2019 were made from CLIs which were 
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being used by RAL. This information has been obtained from RAL’s CSP 
and is reasonably relied upon by the Commissioner. These calls were 
not screened by RAL against the TPS register, rather RAL sought to rely 
on evidence of consent purportedly obtained by its data suppliers for 


the purposes of its direct marketing calls. The Commissioner is 


satisfied that the consent relied on is not valid. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner does not consider that RAL deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether RAL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 
She is satisfied that this condition is met, given that RAL relied 
apparently entirely on indirect consent, without carrying out any 
independent TPS checks of its own, and the fact that the issue of 
unsolicited calls has been widely publicised by the media as being a 


problem. 
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The Commissioner has also published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 
receive calls; or to any number registered with the TPS, unless the 
subscriber has specifically consented to receive calls. It also makes it 
clear that particular care must be taken when relying on “indirect 
consent” and that it is not acceptable to rely on assurances given by 


third party suppliers without undertaking proper due diligence. 


The Commissioner’s direct marketing guidance also makes clear that 
organisations acquiring marketing lists from a third party must 
undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. Whilst RAL 
have attempted to provide evidence of some due diligence, the 
Commissioner is concerned that these steps did not go far enough. 
RAL were notified by the TPS on each occasion that a complaint was 
received, with 67 of these being during the period of contravention and 
a further 75 outside of the period of contravention (from January 2018 
- December 2018). The very existence of these complaints should 
have made RAL aware of the risk that such contraventions may occur, 


and were indeed occurring. 


It is therefore reasonable to suppose that RAL should have been aware 


of its responsibilities in this area. 
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Secondly, the Commissioner has gone on to consider whether RAL 


failed to take reasonable steps to prevent the contravention. Again, she 


is satisfied that this condition is met. 


Organisations buying marketing lists from third parties, or contracting 
with third parties to carry out marketing for them, must make rigorous 
checks to satisfy themselves that the third party has obtained the 
personal data it is using fairly and lawfully, and that they have the 


necessary consent. 


The way in which consent was obtained by the data suppliers is 
unlikely to be fair, and the consents themselves cannot be said to be 
valid in accordance with the Commissioner’s extensive direct marketing 
guidance, however RAL appear content to have relied upon it without 
corroboration. Furthermore, RAL made no attempt to screen the data 
against the TPS register, nor is there any evidence that it sought 


advice from the Commissioner as to its intended practices. 


The Commissioner takes the view that RAL failed to take reasonable 


steps to prevent the contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 


feature of this case: 


e There is evidence of complaints prior to, and beyond, the period 


of contravention, despite the Commissioner’s involvement. 
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The Commissioner has also taken into account the following 


mitigating feature of this case: 


e There is evidence that RAL sought to undertake some, albeit 


insufficient, steps of due diligence. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by RAL on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on RAL. She has decided on the information that is available to 
her, and on the particular circumstances of this case, that a penalty 


notice remains the appropriate course of action. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 


concern. A monetary penalty in this case should act as a general 
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encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 


to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £180,000 (one hundred and eighty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 25 February 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government's general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
24 February 2021 the Commissioner will reduce the monetary 
penalty by 20% to £144,000 (one hundred and forty four 
thousand pounds). However, you should be aware that the early 
payment discount is not available if you decide to exercise your right of 


appeal. 
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60. There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


61. Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
62. Information about appeals is set out in Annex 1. 


63. The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


64. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 


Scotland, the monetary penalty can be enforced in the same manner as 
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an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 25t day of January 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 
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LE1 8D) 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

C) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the 
notice of appeal must include a request for an extension of time 


and the reason why the notice of appeal was not provided in 


time. 


5; Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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